Institutionelle Identitaets-Governance-Schicht Institutional Identity Governance Layer Camada de Governanca de Identidade Institucional

Zusammenfassung Abstract Resumo

10.1 — Das Problem: Institutionelle Identitaetssimulation 10.1 — The Problem: Institutional Identity Simulation 10.1 — O Problema: Simulacao de Identidade Institucional

Moderne grosse Sprachmodelle koennen Text produzieren, der ueberzeugend den Kommunikationsstil, die Terminologie und die strukturellen Muster spezifischer Institutionen annimmt. Wenn sie gebeten werden, einen Brief im Stil eines Regierungsministeriums, einer Finanzaufsicht oder eines oeffentlichen Unternehmens zu verfassen, kann die Ausgabe korrekte Formatierungskonventionen, angemessene rechtliche Verweise, charakteristische Formulierungen und sogar institutionelle Werte enthalten. Modern large language models can produce text that convincingly adopts the communication style, terminology, and structural patterns of specific institutions. When asked to draft a letter in the style of a government ministry, a financial regulator, or a public enterprise, the output may include correct formatting conventions, appropriate legal references, characteristic phrasing, and even institutional values — all without any formal relationship between the AI system operator and the referenced institution. Modelos de linguagem modernos podem produzir texto que adota convincentemente o estilo de comunicacao, terminologia e padroes estruturais de instituicoes especificas. Quando solicitados a redigir uma carta no estilo de um ministerio governamental, um regulador financeiro ou uma empresa publica, a saida pode incluir convencoes de formatacao corretas, referencias legais apropriadas, frases caracteristicas e ate valores institucionais.

Diese Faehigkeit fuehrt eine Risikokategorie ein, die bestehende KI-Governance-Frameworks nicht angemessen adressieren. Die EU-KI-Verordnung legt Transparenzanforderungen fuer KI-generierte Inhalte fest (Artikel 50) und verbietet bestimmte manipulative Praktiken (Artikel 5), regelt aber nicht spezifisch die Simulation institutioneller Identitaet bei der Dokumentenerstellung. This capability introduces a category of risk that existing AI governance frameworks do not adequately address. The EU AI Act establishes transparency requirements for AI-generated content (Article 50) and prohibits certain manipulative practices (Article 5), but does not specifically govern the simulation of institutional identity in document generation. Yet the practical consequences are significant: a convincingly formatted letter bearing institutional language patterns could be mistaken for official communication, undermining both institutional trust and document integrity. Essa capacidade introduz uma categoria de risco que os frameworks de governanca de IA existentes nao abordam adequadamente. O EU AI Act estabelece requisitos de transparencia para conteudo gerado por IA (Artigo 50) e proibe certas praticas manipulativas (Artigo 5), mas nao governa especificamente a simulacao de identidade institucional na geracao de documentos.

Die Herausforderung besteht nicht darin, jegliche institutionelle Sprache in KI-gestuetzten Dokumenten zu verhindern — es gibt legitime Anwendungsfaelle wie Training, Simulation, Entwurfshilfe und Stilmodellierung. Die Herausforderung besteht darin, einen Governance-Mechanismus zu etablieren, der zwischen autorisierter und nicht autorisierter Nutzung unterscheidet. The challenge is not to prevent all institutional language in AI-assisted documents — there are legitimate use cases including training, simulation, drafting assistance, and style modelling. The challenge is to establish a governance mechanism that distinguishes between authorised and unauthorised usage, enforces appropriate transparency, and maintains an auditable record of institutional identity references. O desafio nao e prevenir toda linguagem institucional em documentos assistidos por IA — existem casos de uso legitimos incluindo treinamento, simulacao, assistencia na redacao e modelagem de estilo. O desafio e estabelecer um mecanismo de governanca que distinga entre uso autorizado e nao autorizado.

10.2 — Das Identitaetslizenz-Framework 10.2 — The Identity License Framework 10.2 — O Framework de Licenca de Identidade

Die Institutionelle Identitaets-Governance-Schicht ist als integraler Bestandteil des WINDI ISP (Institutional Style Profile) Systems implementiert. Jedes institutionelle Profil enthaelt einen identity_license-Block, der den Autorisierungsstatus fuer die Nutzung institutioneller Identitaet deklariert und den Durchsetzungsbereich definiert. The Institutional Identity Governance Layer is implemented as an integral component of the WINDI ISP (Institutional Style Profile) system. Each institutional profile contains an identity_license block that declares the authorisation status for institutional identity usage and defines the enforcement scope. A Camada de Governanca de Identidade Institucional e implementada como um componente integral do sistema WINDI ISP (Institutional Style Profile). Cada perfil institucional contem um bloco identity_license que declara o status de autorizacao para uso de identidade institucional e define o escopo de aplicacao.

10.2.0 — Design-Prinzipien 10.2.0 — Design Principles 10.2.0 — Principios de Design

Die Identitaets-Governance-Schicht basiert auf vier Design-Prinzipien, die aus dem empirischen Entdeckungsprozess abgeleitet wurden: The Identity Governance Layer is built on four design principles derived from the empirical discovery process: A Camada de Governanca de Identidade e construida sobre quatro principios de design derivados do processo de descoberta empirica:

10.2.1 — Lizenzstatus 10.2.1 — License States 10.2.1 — Estados de Licenca

Das Framework definiert fuenf Lizenzstatus, von denen jeder unterschiedliches Governance-Verhalten ausloest: The framework defines five license states, each triggering distinct governance behaviour: O framework define cinco estados de licenca, cada um acionando comportamento de governanca distinto:

{
  "identity_license": {
    "status": "model_only",        // authorized | model_only | pending | expired | revoked
    "authorized_by": null,
    "authorization_ref": null,
    "valid_from": null,
    "valid_until": null,
    "scope": {
      "logo": false,
      "letterhead": false,
      "institutional_tone": true,
      "values_reference": true,
      "official_address": false
    },
    "disclaimer_required": true,
    "logo_allowed": false
  }
}

10.2.2 — Verhaltensmatrix 10.2.2 — Behaviour Matrix 10.2.2 — Matriz de Comportamento

Die Governance-Engine erzwingt unterschiedliche Einschraenkungen basierend auf dem Lizenzstatus. Die folgende Matrix definiert das Systemverhalten fuer jede Kombination von Lizenzstatus und Identitaetselement: The governance engine enforces different constraints based on the license state. The following matrix defines the system's behaviour for each combination of license status and identity element: O motor de governanca aplica diferentes restricoes com base no estado da licenca. A matriz a seguir define o comportamento do sistema para cada combinacao de status de licenca e elemento de identidade:

Table 1 — Identity License Behaviour Matrix: governance enforcement per license state

10.2.3 — Abgestufte Durchsetzung 10.2.3 — Graduated Enforcement 10.2.3 — Aplicacao Graduada

Ein wichtiges Design-Prinzip ist die abgestufte Durchsetzung anstelle von binaerer Erlaubnis/Verweigerung. Der model_only-Status — der in der Praxis am haeufigsten vorkommt — erlaubt institutionelle Sprachmuster fuer legitime Anwendungsfaelle (Schulungsdokumente, Stilsimulation, Entwurfshilfe) bei gleichzeitiger Durchsetzung automatischer Haftungsausschluesse und Logo-Sperrung. A key design principle is graduated enforcement rather than binary allow/deny. The model_only state — the most common in practice — permits institutional language patterns for legitimate use cases (training documents, style simulation, drafting assistance) while enforcing automatic disclaimer insertion and logo blocking. This approach recognises that institutional language simulation has valid applications and should be governed, not prohibited. Um principio de design chave e a aplicacao graduada em vez de permissao/negacao binaria. O estado model_only — o mais comum na pratica — permite padroes de linguagem institucional para casos de uso legitimos (documentos de treinamento, simulacao de estilo, assistencia na redacao) enquanto aplica insercao automatica de avisos e bloqueio de logotipos.

Der authorized-Status hingegen repraesentiert eine formelle Beziehung zwischen dem Systembetreiber und der referenzierten Institution, dokumentiert durch eine verifizierbare Autorisierungsreferenz. Dieser Status entsperrt Identitaetselemente (Logo, Briefkopf, offizielle Adresse) gemaess einem definierten Umfang. The authorized state, by contrast, represents a formal relationship between the system operator and the referenced institution, documented through a verifiable authorization reference. This state unlocks identity elements (logo, letterhead, official address) according to a defined scope, enabling fully branded document generation under governance control. O estado authorized, em contraste, representa uma relacao formal entre o operador do sistema e a instituicao referenciada, documentada atraves de uma referencia de autorizacao verificavel. Este estado desbloqueia elementos de identidade (logo, papel timbrado, endereco oficial) de acordo com um escopo definido.

---

10.3 — Durchsetzungsarchitektur 10.3 — Enforcement Architecture 10.3 — Arquitetura de Aplicacao

Die Identitaets-Governance-Schicht arbeitet innerhalb der WINDI-Governance-Engine als Validierungsschritt waehrend der Dokumentenerstellung. Wenn die Engine institutionelle Referenzen erkennt — entweder durch explizite ISP-Profilauswahl oder durch automatische Schluesselworterkennung des Identity Detectors — loest sie den Identitaetslizenz-Validierungsablauf aus. The Identity Governance Layer operates within the WINDI governance engine as a validation step during document generation. When the engine detects institutional references — either through explicit ISP profile selection or through the Identity Detector's automated keyword recognition — it triggers the identity license validation flow. A Camada de Governanca de Identidade opera dentro do motor de governanca WINDI como uma etapa de validacao durante a geracao de documentos. Quando o motor detecta referencias institucionais — seja atraves de selecao explicita de perfil ISP ou atraves de reconhecimento automatico de palavras-chave do Identity Detector — ele aciona o fluxo de validacao de licenca de identidade.

10.4 — Der Identitaets-Governance-Auditblock 10.4 — The Identity Governance Audit Block 10.4 — O Bloco de Auditoria de Governanca de Identidade

Jedes Dokument, das ueber WINDIs MEDIUM- oder HIGH-Governance-Stufen generiert wird und eine institutionelle Identitaet referenziert, erzeugt einen strukturierten identity_governance-Block in seinen Metadaten. Dieser Block dient als forensische Aufzeichnung von Identitaetsnutzungsentscheidungen und ermoeglicht nachtraegliche Verifizierung und Compliance-Audits. Every document generated through WINDI's MEDIUM or HIGH governance tiers that references an institutional identity produces a structured identity_governance block in its metadata. This block serves as a forensic record of identity usage decisions, enabling post-hoc verification and compliance auditing. Todo documento gerado atraves dos niveis de governanca MEDIUM ou HIGH do WINDI que referencia uma identidade institucional produz um bloco identity_governance estruturado em seus metadados. Este bloco serve como registro forense de decisoes de uso de identidade, permitindo verificacao posterior e auditoria de conformidade.

// Actual system output — Bundesregierung MEDIUM document
{
  "identity_governance": {
    "institution": "Bundesregierung (Model)",
    "license_status": "model_only",
    "logo_allowed": false,
    "disclaimer_required": true,
    "disclaimer_text": "This document uses institutional language for model or simulation purposes. It is not an official document issued by the mentioned institution.",
    "audit_category": "model_simulation",
    "authorization_ref": null,
    "restrictions": [
      "Model/simulation use only",
      "No official government identity permitted",
      "Disclaimer required on all documents"
    ]
  }
}

Fig. 2 — Identity governance audit block from production system (Bundesregierung MEDIUM profile, 01 February 2026)

Dieser Auditblock wird nicht rekonstruiert — er wird zum Zeitpunkt der Generierung erfasst und in den Governance-Beleg des Dokuments aufgenommen. Fuer HIGH-Level-Dokumente werden die Identitaets-Governance-Daten zusaetzlich im forensischen Ledger mit manipulationssicherem Hashing aufgezeichnet. This audit block is not reconstructed — it is captured at generation time and included in the document's governance receipt. For HIGH-level documents, the identity governance data is additionally recorded in the forensic ledger with tamper-evident hashing, ensuring that identity usage decisions cannot be retroactively altered. Este bloco de auditoria nao e reconstruido — ele e capturado no momento da geracao e incluido no recibo de governanca do documento. Para documentos de nivel HIGH, os dados de governanca de identidade sao adicionalmente registrados no ledger forense com hashing a prova de adulteracao.

10.5 — Auswirkung: Vor und Nach Identitaets-Governance 10.5 — Impact: Before and After Identity Governance 10.5 — Impacto: Antes e Depois da Governanca de Identidade

Fig. 3 — Comparative impact analysis of the Identity Governance Layer

10.5.1 — Angewandte Szenarien 10.5.1 — Applied Scenarios 10.5.1 — Cenarios Aplicados

Die folgende Tabelle veranschaulicht, wie die Identitaets-Governance-Schicht in verschiedenen institutionellen Kontexten funktioniert, die derzeit im ISP-Register modelliert sind. Jedes Szenario demonstriert die praktische Auswirkung des Lizenzstatus auf das Dokument-Governance-Verhalten. The following table illustrates how the Identity Governance Layer operates across different institutional contexts currently modelled in the ISP Registry. Each scenario demonstrates the practical effect of the license status on document governance behaviour. A tabela a seguir ilustra como a Camada de Governanca de Identidade opera em diferentes contextos institucionais atualmente modelados no Registro ISP. Cada cenario demonstra o efeito pratico do status da licenca no comportamento de governanca de documentos.

Table 2 — Applied governance scenarios across six institutional profiles from the ISP Registry v2.5.0

10.6 — Regulatorische Ausrichtung 10.6 — Regulatory Alignment 10.6 — Alinhamento Regulatorio

Die Identitaets-Governance-Schicht adressiert Anforderungen, die mehrere regulatorische Rahmenwerke umspannen, von denen keines speziell das Problem der institutionellen Identitaetssimulation in der KI-gestuetzten Dokumentenerstellung antizipiert. The Identity Governance Layer addresses requirements that span multiple regulatory frameworks, none of which specifically anticipate the problem of institutional identity simulation in AI-assisted document generation. A Camada de Governanca de Identidade aborda requisitos que abrangem multiplos frameworks regulatorios, nenhum dos quais antecipa especificamente o problema da simulacao de identidade institucional na geracao de documentos assistida por IA.

10.7 — Methodologische Anmerkung 10.7 — Methodological Note 10.7 — Nota Metodologica

Die Identitaets-Governance-Schicht wurde nicht aus theoretischen Anforderungen entworfen. Sie entstand aus bereitstellungsgetriebener Entdeckung — einer Methodik, bei der architektonische Entscheidungen aus realen Testfaellen abgeleitet werden, die in produktionsaehnlichen Umgebungen ausgefuehrt werden. The Identity Governance Layer was not designed from theoretical requirements. It emerged from deployment-driven discovery — a methodology where architectural decisions are derived from real-world test cases executed in production-like environments. The Banco do Brasil letter case study demonstrated that institutional identity simulation is a governance concern before this concern was formally specified in the system's requirements. A Camada de Governanca de Identidade nao foi projetada a partir de requisitos teoricos. Ela emergiu da descoberta orientada por implantacao — uma metodologia onde decisoes arquitetonicas sao derivadas de casos de teste do mundo real executados em ambientes similares a producao.

Dieser Ansatz — Governance-Mechanismen als Reaktion auf empirisch beobachtete Risiken statt auf antizipierte Risiken zu entwickeln — stimmt mit der iterativen Entwicklungsmethodik ueberein, die das WINDI-System charakterisiert. This approach — building governance mechanisms in response to empirically observed risks rather than anticipated risks — aligns with the iterative development methodology that characterises the WINDI system. The ISP Registry evolved from a single profile (Deutsche Bahn, 31 January 2026) to eight profiles across three governance tiers (02 February 2026), with each deployment revealing new governance requirements that were then integrated into the framework. Esta abordagem — construir mecanismos de governanca em resposta a riscos empiricamente observados em vez de riscos antecipados — alinha-se com a metodologia de desenvolvimento iterativo que caracteriza o sistema WINDI.

Die akademische Bedeutung dieser Methodik besteht darin, dass sie eine Rueckkopplungsschleife zwischen Bereitstellung und Design demonstriert: Der Akt der Bereitstellung institutioneller Profile in einem Produktionssystem generiert Erkenntnisse, die sofort in die Governance-Architektur integriert werden. The academic significance of this methodology is that it demonstrates a feedback loop between deployment and design: the act of deploying institutional profiles in a production system generates insights that are immediately incorporated into the governance architecture, producing a system that is both empirically grounded and theoretically coherent. O significado academico desta metodologia e que ela demonstra um ciclo de feedback entre implantacao e design: o ato de implantar perfis institucionais em um sistema de producao gera insights que sao imediatamente incorporados na arquitetura de governanca.

← TR-006: ISP Registry v2.5.0 TR-007: Secure Origin Framework →